16 CFR §314.1 — Purpose and scope (FTC GLBA Safeguards Rule)

glba-safeguards-16cfr-314-1

16 CFR §314.1 sets the purpose and scope of the FTC Safeguards Rule, which implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act for non-bank financial institutions under FTC enforcement jurisdiction.

Get this register: .xlsx .csv More bundles →

source:
  type: regulation
  id: glba-safeguards-16cfr-314.1
  authority: 16 CFR §314.1 — Purpose and scope (FTC GLBA Safeguards Rule)
  description: |
    16 CFR §314.1 sets the purpose and scope of the FTC Safeguards Rule,
    which implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley
    Act for non-bank financial institutions under FTC enforcement
    jurisdiction.
obligations:
  - id: glba-safeguards-16cfr-314.1-a-purpose-applies-to-customer-info
    canonical_id: glba-safeguards-16cfr-314.1-a-purpose-applies-to-customer-info
    section: '16 CFR §314.1(a) — Purpose: safeguards for customer information'
    description: |
      [LENDER] shall develop, implement, and maintain reasonable
      administrative, technical, and physical safeguards to protect the
      security, confidentiality, and integrity of customer information,
      consistent with the FTC Safeguards Rule's implementation of GLBA
      sections 501 and 505(b)(2).
    type: do
    audit_question: Can [LENDER] demonstrate it has adopted reasonable administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information as required by 16 CFR §314.1(a)?
    program_review: Do the P&Ps ensure [LENDER] develops, implements, and maintains reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information, consistent with the Safeguards Rule?
    file_review: Review the information-security program for administrative/technical/physical safeguards; the compliance person judges whether the safeguards are reasonable for [LENDER]'s customer information.
    judgment: true
    feeds: []
    workflow_phase: governance
    owner_role: compliance_officer
    secondary_owner_role: ''
    cadence: continuous
    consequence: ''
    tags:
      - round-b
      - regulator-direct
      - glba
      - safeguards-rule
      - ftc
      - scope
      - customer-information
      - promoted
    primary_source:
      tier: 1
      authority: 16 CFR §314.1(a)
      source_class: ftc-safeguards-rule
      source_url: https://www.law.cornell.edu/cfr/text/16/314.1
      snapshot_id: 0ed053c1b58a0dc2
      fetched_at: '2026-05-24T00:43:57Z'
      content_hash: sha256:74f563679c0dddc33c585aa501382bc49cb7731e32bfb3ebf839d6282c544a83
      paragraph_quote: (a) Purpose. This part, which implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act , sets forth standards for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information .
      drafter_attestation: |
        Copied verbatim from snapshot 0ed053c1b58a0dc2 (content.txt) at
        2026-05-23T00:50Z. Substring is the §314.1(a) operative purpose
        paragraph.
    promoted_at: '2026-05-24T01:20:04+00:00'
    promoted_from: glba-safeguards-16cfr-314.1-roundb-v1.yaml
  - id: glba-safeguards-16cfr-314.1-b-scope-applies-to-ftc-financial-institutions
    canonical_id: glba-safeguards-16cfr-314.1-b-scope-applies-to-ftc-financial-institutions
    section: '16 CFR §314.1(b) — Scope: applies to FTC-jurisdiction financial institutions including mortgage lenders and brokers'
    description: |
      The FTC Safeguards Rule applies to the handling of customer
      information by financial institutions over which the FTC has
      enforcement jurisdiction. Where [LENDER] is a mortgage lender or
      mortgage broker not otherwise subject to another regulator's
      enforcement authority under GLBA section 505, [LENDER] is subject
      to this part and to all customer information in its possession,
      including information pertaining to customers of other financial
      institutions that have provided such information to [LENDER].
    type: do
    audit_question: Has [LENDER] confirmed and documented its status as a "financial institution" subject to the FTC Safeguards Rule under 16 CFR §314.1(b), and does its information-security program cover all customer information in its possession (including information received from other financial institutions)?
    program_review: Does the program account for [LENDER]'s status as a Safeguards-Rule-covered financial institution and ensure the program covers ALL customer information in [LENDER]'s possession — including information received from other financial institutions?
    file_review: Confirm the documented covered-institution determination and that the program's scope statement reaches all customer information in possession, including third-party-sourced data.
    judgment: false
    feeds: []
    workflow_phase: governance
    owner_role: compliance_officer
    secondary_owner_role: ''
    cadence: annual
    consequence: ''
    tags:
      - round-b
      - regulator-direct
      - glba
      - safeguards-rule
      - ftc
      - scope
      - applicability
      - promoted
    primary_source:
      tier: 1
      authority: 16 CFR §314.1(b)
      source_class: ftc-safeguards-rule
      source_url: https://www.law.cornell.edu/cfr/text/16/314.1
      snapshot_id: 0ed053c1b58a0dc2
      fetched_at: '2026-05-24T00:43:57Z'
      content_hash: sha256:74f563679c0dddc33c585aa501382bc49cb7731e32bfb3ebf839d6282c544a83
      paragraph_quote: This part applies to all customer information in your possession, regardless of whether such information pertains to individuals with whom you have a customer relationship, or pertains to the customers of other financial institutions that have provided such information to you .
      drafter_attestation: |
        Copied verbatim from snapshot 0ed053c1b58a0dc2 (content.txt) at
        2026-05-23T00:50Z. Substring is the §314.1(b) closing sentence
        defining the scope of customer information covered.
    promoted_at: '2026-05-24T01:20:04+00:00'
    promoted_from: glba-safeguards-16cfr-314.1-roundb-v1.yaml
_promotion_history:
  - promoted_at: '2026-05-24T01:20:04+00:00'
    candidate_path: obligations\_remediation\_round_b_drafts\glba-safeguards-16cfr-314.1-roundb-v1.yaml
    candidates_promoted: 2
    candidates_skipped_existing: 0

Verbatim regulatory text (2)

Verbatim provisions from 16 CFR §314.1 — Purpose and scope (FTC GLBA Safeguards Rule) — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.

16 CFR §314.1(a) — Purpose: safeguards for customer information

(a) Purpose. This part, which implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act , sets forth standards for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information .

Source: 16 CFR §314.1(a) · source URL · snapshot 0ed053c1b58a0dc2

16 CFR §314.1(b) — Scope: applies to FTC-jurisdiction financial institutions including mortgage lenders and brokers

This part applies to all customer information in your possession, regardless of whether such information pertains to individuals with whom you have a customer relationship, or pertains to the customers of other financial institutions that have provided such information to you .

Source: 16 CFR §314.1(b) · source URL · snapshot 0ed053c1b58a0dc2